| 30,6 → 30,7 |
|---|
| BL_IP_CAT="/usr/local/share/iptables-bl-enabled" # categories files of the BlackListed IP |
| BL_IP_OSSI="/usr/local/share/iptables-bl/ossi" # ossi categoty |
| WL_IP_OSSI="/usr/local/share/ossi-ip-wl" # ip of the whitelist |
| DNSMASQ_WL_ENABLED="/usr/local/share/dnsmasq-wl-enabled" # enabled domain names for the Whitelist |
| TMP_users_set_save="/tmp/users_set_save" # tmp file for backup users set |
| TMP_set_save="/tmp/ipset_save" # tmp file for blacklist and whitelist creation |
| QOS=`grep ^QOS= $conf_file|cut -d"=" -f2` # QOS (on/off) |
| 92,13 → 93,12 |
|---|
| |
| # Calcul de la taille du set de la blacklist |
| # Compute the blacklist set length |
| cd $BL_IP_CAT |
| set_bl_length=$(($(wc -l * | awk '{print $1}' | tail -n 1)+$(wc -l $BL_IP_OSSI | awk '{print $1}'))) |
| bl_set_length=$(($(wc -l $BL_IP_CAT/* | awk '{print $1}' | tail -n 1)+$(wc -l $BL_IP_OSSI | awk '{print $1}'))) |
| |
| # Création du fichier set temporaire, remplissage, chargement et suppression |
| # Creating the temporary set file, filling, loading and deleting |
| echo "create blacklist_ip_blocked hash:net family inet hashsize 1024 maxelem $set_bl_length" > $TMP_set_save |
| for category in `ls -1 | cut -d '@' -f1` |
| echo "create blacklist_ip_blocked hash:net family inet hashsize 1024 maxelem $bl_set_length" > $TMP_set_save |
| for category in `ls -1 $BL_IP_CAT | cut -d '@' -f1` |
| do |
| cat $BL_IP_CAT/$category >> $TMP_set_save |
| done |
| 113,9 → 113,13 |
|---|
| ipset del blacklist_ip_blocked $ip |
| done |
| |
| # Calcul de la taille du set de la whitelist |
| # Compute the whitelist set length |
| wl_set_length=$(($(wc -l $DNSMASQ_WL_ENABLED/* | awk '{print $1}' | tail -n 1)*3)) |
| |
| # Création du fichier set temporaire, remplissage, chargement et suppression |
| # Creating the temporary set file, filling, loading and deleting |
| echo "create whitelist_ip_allowed hash:net family inet hashsize 1024" > $TMP_set_save |
| echo "create whitelist_ip_allowed hash:net family inet hashsize 1024 maxelem $wl_set_length" > $TMP_set_save |
| cat $WL_IP_OSSI >> $TMP_set_save |
| ipset -! restore < $TMP_set_save |
| rm -f $TMP_set_save |
| 158,18 → 162,22 |
|---|
| # Mark (and log) the 8091 direct attempts to REJECT them in INPUT rules |
| $IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8091 -j MARK --set-mark 5 |
| |
| # Aiguillage des flux DNS |
| # Switching DNS streams |
| # havp_bl_set --> redirection vers le port 54 |
| # havp_bl_set --> redirect to port 54 |
| $IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl_set src -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 54 |
| |
| # havp_wl_set --> redirection vers le port 55 |
| # havp_wl_set --> redirect to port 55 |
| $IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl_set src -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 55 |
| |
| # Redirection des requêtes HTTP des IP de la blacklist vers ALCASAR (page 'accès interdit') pour le set havp_bl_set |
| # Redirect outbound HTTP requests from blacklist IP to ALCASAR ('access denied' page) for the set havp_bl_set |
| $IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl_set src -m set --match-set blacklist_ip_blocked dst -p tcp --dport http -j REDIRECT --to-port 80 |
| |
| # Redirection des requêtes HTTP des IP qui ne sont pas dans la whitelist vers ALCASAR (page 'accès interdit') pour le set havp_wl_set |
| # Redirect outbound HTTP requests from IP which are not in the whitelist to ALCASAR ('access denied' page) for the set havp_wl_set |
| $IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl_set src -m set ! --match-set whitelist_ip_allowed dst -p tcp --dport http -j REDIRECT --to-port 80 |
| |
| # Journalisation des requètes HTTP vers Internet (seulement les paquets SYN) - Les autres protocoles sont journalisés en FORWARD par netflow |
| ## Log HTTP requests to Internet (only syn packets) - Other protocols are log in FORWARD by netflow |
| $IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p tcp --dport http -m state --state NEW -j ULOG --ulog-prefix "RULE F_http -- ACCEPT " |
| 286,7 → 294,7 |
|---|
| $IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset |
| $IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable |
| |
| # interdiction d'accès à INTIF (n'est utile que lorsque chilli est arrêté). |
| # Interdiction d'accès à INTIF (n'est utile que lorsque chilli est arrêté). |
| # Reject INTIF access (only when chilli is down) |
| $IPTABLES -A INPUT -i $INTIF -j ULOG --ulog-prefix "RULE Protect1 -- REJECT " |
| $IPTABLES -A INPUT -i $INTIF -j REJECT |